>
    Strata Copilot
    Network > Proxy
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS Web Interface Help
    4. Network
    5. Network > Proxy
    Download PDF
    Next-Generation Firewall

    Network > Proxy

    Table of Contents

    Network > Proxy

    The availability of proxy configuration options is based on the proxy type. You must first configure a DNS proxy object to configure a proxy.
    Proxy Fields
    Description
    Proxy Enablement
    Proxy Type
    Select the type of proxy you want to use.
    • None—The proxy is deactivated.
    • Explicit—Configure the proxy so that the request contains the destination IP address of the configured proxy and the client browser sends requests to the proxy directly.
    • Transparent—Configure the proxy so that the request contains the destination IP address of the web server and the client browser is redirected to the proxy.
      Transparent Proxy requires a specific Destination NAT (DNAT) policy rule to successfully configure the web proxy. Refer to the PAN-OS Networking Administrator’s Guide documentation for the complete procedure.
    • Palo Alto Networks Service Proxy—Configure the proxy to forward communications from firewalls in the downstream network to destinations in the upstream network. The firewall can act as a single proxy or as one in a series of proxies.
      This proxy mode is supported on PA-1400, PA-3400, PA5400, PA 5450, PA 5500, VM-300, VM-500, and VM-700 firewalls running PAN-OS 11.0.1-h2 or later. To enable a firewall to support this proxy type and display it as an option here, enter the following CLI command and then reboot your firewall: set system setting paloalto-networks-service-proxy on
    Proxy Configuration
    Connect Timeout
    Specify (in seconds) how long the proxy waits for a response from the web server. The range is 1–60 seconds and the default is 5 seconds. If there is no response after the specified amount of time has elapsed, the proxy closes the connection.
    Listening Interface Explicit Proxy only
    Specify the Layer 3 (L3) interface where the firewall checks for traffic to reroute to the proxy.
    Upstream Interface
    Select the upstream interface.
    If you are using a loopback interface, specify that interface as the Upstream Interface.
    Proxy IP
    Specify the IP address of the interface where the firewall should check for traffic to reroute to the proxy (listening interface).
    DNS Proxy
    Select the DNS proxy object you want to use for the proxy connection.
    Check domain in CONNECT & SNI are the same Explicit Proxy only
    Enable this option to prevent domain fronting attacks caused by specifying different domains between the CONNECT request and the Server Name Indication (SNI) field in the HTTP header.
    Authentication service type Explicit Proxy only
    Select the type of service you want to use to authenticate users.
    • No authentication—Exempt all explicit web proxy traffic from authentication.
      If you select this option, all proxy connections are unauthenticated and the firewall or Panorama does not create logs for authentication events.
    • SAML/CAS—Use a SAML 2.0 based authentication service or the authentication service available in the Cloud Identity Engine.
      This option requires Prisma Access, the Cloud Services 3.2.1 plugin, and the add-on web proxy license.
    • Kerberos Single Sign On—Use the Kerberos Single Sign-On Service to authenticate users.
      This option requires Panorama, a web proxy license, and an authentication profile that uses Kerberos Single Sign-On Service on the firewall.
    • HTTP 407 challenge is applicable to all basic authentication types.
      Local Database—Authenticate users against the firewall's local user database using basic authentication.
    • LDAP—Authenticate users against an LDAP server using basic authentication.
    • RADIUS—Authenticate users against a RADIUS server using basic authentication.
    • TACACS+—Authenticate users against a TACACS+ server using basic authentication.
    • Kerberos Pre-Authentication—Authenticate users using Kerberos pre-authentication with basic authentication.
    • Authentication Sequence—Authenticate users against a sequence of authentication servers (LDAP, RADIUS, TACACS+, Kerberos Pre-Authentication, or Local Database).
    Authentication Profile Explicit Proxy only
    Select the authentication profile you want to use for the Authentication service type you selected for the previous option.
    Basic Authentication Realm Explicit Proxy only
    Enter a realm name to identify the authentication scope presented to clients in the HTTP 407 Proxy Authentication Required response. The realm name supports alphanumeric characters, spaces, hyphens, underscores, and periods, up to 127 characters. The default is Explicit Proxy.
    This field is available when you select a basic authentication type for Authentication service type.
    IP Surrogate Minutes Explicit Proxy only
    Enter the number of minutes (0–600) to cache an authenticated user's IP address. While the cache entry is valid, subsequent requests from that IP address are not challenged for credentials again. The default is 0, which disables IP surrogate.
    Don't enable IP Surrogate Minutes in NAT environments or virtual desktop infrastructure (VDI) deployments where multiple users share a single IP address. In those deployments, all users behind the shared IP are treated as authenticated once any one user authenticates.
    The IP surrogate cache is stored in memory and does not persist when Envoy proxy or the device restarts. After a restart, users must authenticate again.
    This field is available when you select a basic authentication type for Authentication service type.

    © 2026 Palo Alto Networks, Inc. All rights reserved.